mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-09-26 20:38:12 +00:00
Code Issues Releases Wiki Activity
linux-stable/net
History
Kuniyuki Iwashima 13d67aa0c2 af_packet: Don't send zero-byte data in packet_sendmsg_spkt(). 
[ Upstream commit 6a341729fb ]

syzkaller reported a warning below [0].

We can reproduce it by sending 0-byte data from the (AF_PACKET,
SOCK_PACKET) socket via some devices whose dev->hard_header_len
is 0.

    struct sockaddr_pkt addr = {
        .spkt_family = AF_PACKET,
        .spkt_device = "tun0",
    };
    int fd;

    fd = socket(AF_PACKET, SOCK_PACKET, 0);
    sendto(fd, NULL, 0, 0, (struct sockaddr *)&addr, sizeof(addr));

We have a similar fix for the (AF_PACKET, SOCK_RAW) socket as
commit dc633700f0 ("net/af_packet: check len when min_header_len
equals to 0").

Let's add the same test for the SOCK_PACKET socket.

[0]:
skb_assert_len
WARNING: CPU: 1 PID: 19945 at include/linux/skbuff.h:2552 skb_assert_len include/linux/skbuff.h:2552 [inline]
WARNING: CPU: 1 PID: 19945 at include/linux/skbuff.h:2552 __dev_queue_xmit+0x1f26/0x31d0 net/core/dev.c:4159
Modules linked in:
CPU: 1 PID: 19945 Comm: syz-executor.0 Not tainted 6.3.0-rc7-02330-gca6270c12e20 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
RIP: 0010:skb_assert_len include/linux/skbuff.h:2552 [inline]
RIP: 0010:__dev_queue_xmit+0x1f26/0x31d0 net/core/dev.c:4159
Code: 89 de e8 1d a2 85 fd 84 db 75 21 e8 64 a9 85 fd 48 c7 c6 80 2a 1f 86 48 c7 c7 c0 06 1f 86 c6 05 23 cf 27 04 01 e8 fa ee 56 fd <0f> 0b e8 43 a9 85 fd 0f b6 1d 0f cf 27 04 31 ff 89 de e8 e3 a1 85
RSP: 0018:ffff8880217af6e0 EFLAGS: 00010282
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffc90001133000
RDX: 0000000000040000 RSI: ffffffff81186922 RDI: 0000000000000001
RBP: ffff8880217af8b0 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000001 R12: ffff888030045640
R13: ffff8880300456b0 R14: ffff888030045650 R15: ffff888030045718
FS:  00007fc5864da640(0000) GS:ffff88806cd00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020005740 CR3: 000000003f856003 CR4: 0000000000770ee0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 55555554
Call Trace:
 <TASK>
 dev_queue_xmit include/linux/netdevice.h:3085 [inline]
 packet_sendmsg_spkt+0xc4b/0x1230 net/packet/af_packet.c:2066
 sock_sendmsg_nosec net/socket.c:724 [inline]
 sock_sendmsg+0x1b4/0x200 net/socket.c:747
 ____sys_sendmsg+0x331/0x970 net/socket.c:2503
 ___sys_sendmsg+0x11d/0x1c0 net/socket.c:2557
 __sys_sendmmsg+0x18c/0x430 net/socket.c:2643
 __do_sys_sendmmsg net/socket.c:2672 [inline]
 __se_sys_sendmmsg net/socket.c:2669 [inline]
 __x64_sys_sendmmsg+0x9c/0x100 net/socket.c:2669
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x3c/0x90 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x72/0xdc
RIP: 0033:0x7fc58791de5d
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 73 9f 1b 00 f7 d8 64 89 01 48
RSP: 002b:00007fc5864d9cc8 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
RAX: ffffffffffffffda RBX: 00000000004bbf80 RCX: 00007fc58791de5d
RDX: 0000000000000001 RSI: 0000000020005740 RDI: 0000000000000004
RBP: 00000000004bbf80 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000000000b R14: 00007fc58797e530 R15: 0000000000000000
 </TASK>
---[ end trace 0000000000000000 ]---
skb len=0 headroom=16 headlen=0 tailroom=304
mac=(16,0) net=(16,-1) trans=-1
shinfo(txflags=0 nr_frags=0 gso(size=0 type=0 segs=0))
csum(0x0 ip_summed=0 complete_sw=0 valid=0 level=0)
hash(0x0 sw=0 l4=0) proto=0x0000 pkttype=0 iif=0
dev name=sit0 feat=0x00000006401d7869
sk family=17 type=10 proto=0

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-05-17 11:11:48 +02:00
..
6lowpan 6lowpan: Off by one handling ->nexthdr 2020-01-27 14:46:30 +01:00
9p 9p/xen : Fix use after free bug in xen_9pfs_front_remove due to race condition 2023-04-20 12:02:11 +02:00
802 mrp: introduce active flags to prevent UAF when applicant uninit 2023-01-18 09:26:32 +01:00
8021q vlan: partially enable SIOCSHWTSTAMP in container 2023-05-17 11:11:41 +02:00
appletalk appletalk: Fix skb allocation size in loopback case 2021-04-07 12:47:02 +02:00
atm net/atm: fix proc_mpc_write incorrect return value 2022-11-03 23:50:51 +09:00
ax25 ax25: Fix UAF bugs in ax25 timers 2022-04-27 13:15:32 +02:00
batman-adv batman-adv: Don't skb_split skbuffs with frag_list 2022-05-18 09:18:05 +02:00
bluetooth bluetooth: Perform careful capability checks in hci_sock_ioctl() 2023-05-17 11:11:37 +02:00
bpf bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb() 2022-11-25 17:36:54 +01:00
bridge netfilter: ebtables: fix memory leak when blob is malformed 2022-09-28 10:56:51 +02:00
caif net: caif: Fix use-after-free in cfusbl_device_notify() 2023-03-17 08:30:37 +01:00
can can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write 2023-04-05 11:14:20 +02:00
ceph libceph: clear con->out_msg on Policy::stateful_server faults 2020-11-05 11:07:03 +01:00
core tcp/udp: Fix memleaks of sk and zerocopy skbs with TX timestamp. 2023-05-17 11:11:42 +02:00
dcb net: dcb: disable softirqs in dcbnl_flush_dev() 2022-03-08 19:01:58 +01:00
dccp dccp: Call inet6_destroy_sock() via sk->sk_destruct(). 2023-04-26 11:18:57 +02:00
decnet net: decnet: Fix sleeping inside in af_decnet 2021-07-28 11:12:18 +02:00
dns_resolver KEYS: Don't write out to userspace while holding key semaphore 2020-04-24 08:01:25 +02:00
dsa net: dsa: Fix duplicate frames flooded by learning 2020-04-02 16:34:24 +02:00
ethernet net: add annotations on hh->hh_len lockless accesses 2020-01-09 10:17:59 +01:00
hsr net: hsr: Fix potential use-after-free 2022-12-08 11:16:32 +01:00
ieee802154 net: ieee802154: fix error return code in dgram_bind() 2022-11-03 23:50:54 +09:00
ife
ipv4 ipv4: Fix potential uninit variable access bug in __ip_make_skb() 2023-05-17 11:11:42 +02:00
ipv6 sit: update dev->needed_headroom in ipip6_tunnel_bind_dev() 2023-05-17 11:11:48 +02:00
ipx
iucv net/iucv: Fix size of interrupt data 2023-03-22 13:26:15 +01:00
kcm kcm: close race conditions on sk_receive_queue 2022-11-25 17:36:54 +01:00
key af_key: Fix send_acquire race with pfkey_register 2022-12-08 11:16:29 +01:00
l2tp inet6: Remove inet6_destroy_sock() in sk->sk_prot->destroy(). 2023-04-26 11:18:57 +02:00
l3mdev
lapb net: lapb: Copy the skb before sending a packet 2021-02-10 09:12:08 +01:00
llc llc: only change llc->dev when bind() succeeds 2022-03-28 08:22:27 +02:00
mac80211 wifi: mac80211: fix invalid drv_sta_pre_rcu_remove calls for non-uploaded sta 2023-04-20 12:02:10 +02:00
mac802154 mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add() 2022-12-14 11:26:14 +01:00
mpls net: mpls: fix stale pointer if allocation fails during device rename 2023-02-22 12:46:06 +01:00
ncsi net/ncsi: Avoid GFP_KERNEL in response handler 2021-04-16 11:57:51 +02:00
netfilter netfilter: nf_tables: deactivate anonymous set from preparation phase 2023-05-17 11:11:48 +02:00
netlabel net: fix NULL pointer reference in cipso_v4_doi_free 2021-09-22 11:45:32 +02:00
netlink netlink: annotate data races around sk_state 2023-02-06 07:46:31 +01:00
netrom netrom: Fix use-after-free caused by accept on already connected socket 2023-02-22 12:46:01 +01:00
nfc nfc: change order inside nfc_se_io error path 2023-03-17 08:30:37 +01:00
nsh
openvswitch net: openvswitch: fix flow memory leak in ovs_flow_cmd_new 2023-02-22 12:46:01 +01:00
packet af_packet: Don't send zero-byte data in packet_sendmsg_spkt(). 2023-05-17 11:11:48 +02:00
phonet phonet: refcount leak in pep_sock_accep 2022-01-11 13:57:37 +01:00
psample net: psample: fix skb_over_panic 2019-12-05 15:38:15 +01:00
qrtr net: qrtr: fix a kernel-infoleak in qrtr_recvmsg() 2021-03-30 14:40:12 +02:00
rds net: rds: don't hold sock lock when cancelling work from rds_tcp_reset_callbacks() 2022-10-26 13:17:00 +02:00
rfkill rfkill: Fix incorrect check to avoid NULL pointer dereference 2020-01-12 12:11:57 +01:00
rose net/rose: Fix to not accept on connected socket 2023-02-22 12:46:05 +01:00
rxrpc rxrpc: Don't try to resend the request if we're receiving the reply 2022-06-14 16:53:50 +02:00
sched net/sched: act_mirred: Add carrier check 2023-05-17 11:11:48 +02:00
sctp sctp: Call inet6_destroy_sock() via sk->sk_destruct(). 2023-04-26 11:18:58 +02:00
smc net/smc: non blocking recvmsg() return -EAGAIN when no data and signal_pending 2022-05-18 09:18:06 +02:00
strparser
sunrpc SUNRPC: remove the maximum number of retries in call_bind_status 2023-05-17 11:11:45 +02:00
switchdev
tipc tipc: improve function tipc_wait_for_cond() 2023-03-17 08:30:38 +01:00
tls
unix af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress 2022-01-27 09:01:00 +01:00
vmw_vsock net: vmw_vsock: vmci: Check memcpy_from_msg() 2023-01-18 09:26:18 +01:00
wimax
wireless wifi: cfg80211: Partial revert "wifi: cfg80211: Fix use after free for wext" 2023-03-13 10:16:26 +01:00
x25 net/x25: Fix to not accept on connected socket 2023-02-22 12:46:02 +01:00
xfrm xfrm: Update ipcomp_scratches with NULL when freed 2022-10-26 13:17:09 +02:00
compat.c net: Return the correct errno code 2021-06-30 08:48:47 -04:00
Kconfig
Makefile net: split out functions related to registering inflight socket files 2021-08-04 12:22:14 +02:00
socket.c net: Fix a data-race around sysctl_somaxconn. 2022-09-05 10:25:04 +02:00
sysctl_net.c